opencode-workflow-guard 1.18.0 → 1.19.0

package/src/lib/verify.ts

@@ -231,11 +231,26 @@ export function resolveVerifyTimeoutMs(root: string): number {
 	return typeof configured === "number" && Number.isFinite(configured) && configured > 0 ? configured : 30_000;
 }
 
+export interface VerifyRun {
+	passed: boolean;
+	output: string;
+	durationMs: number;
+	/**
+	 * Set when the command was killed at the timeout rather than exiting on its
+	 * own. A timeout is not a failing assertion: it says nothing about whether
+	 * the change is correct, and the remedy is a longer limit, not a code fix.
+	 * Callers that report a reason must attribute it, or the agent chases a
+	 * failure that does not exist.
+	 */
+	timedOut?: boolean;
+	timeoutMs?: number;
+}
+
 export async function runVerify(
 	command: string,
 	root: string,
 	timeoutMs = 30_000,
-): Promise<{ passed: boolean; output: string; durationMs: number }> {
+): Promise<VerifyRun> {
 	const start = Date.now();
 	const allowLive = process.env.WORKFLOW_GUARD_ALLOW_LIVE === "1";
 
@@ -294,6 +309,8 @@ export async function runVerify(
 					passed: false,
 					output: output + `\n(Verification timed out after ${Math.round(timeoutMs / 1000)}s)`,
 					durationMs: Date.now() - start,
+					timedOut: true,
+					timeoutMs,
 				});
 			});
 		}, timeoutMs);

package/src/workflow-guard.ts

@@ -24,9 +24,11 @@ import { ToolInvocationLifecycle } from "./lib/tool-lifecycle.ts";
 import { ToolOutcomeTracker, type ToolOutcomePart } from "./lib/tool-outcomes.ts";
 import { guardToolCallImpl, isMutatingSurfaceTool, isReadOnlyRole, SHELL_TOOL_NAMES } from "./lib/guard-dispatcher.ts";
 import { createCustomTools, buildWorkflowGuardSystemGuidance } from "./lib/custom-tools.ts";
+import { evaluateDogfoodGate } from "./lib/dogfood.ts";
 import type { PolicyDecision, TodoSdkClient } from "./lib/types.ts";
 export { isReadOnlyRole } from "./lib/guard-dispatcher.ts";
 export { extractReviewFollowups, buildWorkflowGuardSystemGuidance } from "./lib/custom-tools.ts";
+export { evaluateDogfoodGate } from "./lib/dogfood.ts";
 
 // ── Types ────────────────────────────────────────────────────────────────────
 export type {
@@ -47,7 +49,7 @@ export type {
 	LearningOpportunity,
 } from "./lib/types.ts";
 export type { TodoSdkClient };
-export { verificationEvidence, reviewEvidence, toolOutcomeEvidence, policyDecisionEvidence, lifecycleStateEvidence, agentAssertionEvidence, evidenceMatchesSubject, isEvidenceFresh } from "./lib/evidence.ts";
+export { verificationEvidence, reviewEvidence, dogfoodEvidence, toolOutcomeEvidence, policyDecisionEvidence, lifecycleStateEvidence, agentAssertionEvidence, evidenceMatchesSubject, isEvidenceFresh } from "./lib/evidence.ts";
 export { getRalphOutcome } from "./policies/continuation.ts";
 
 // ── State & runtime context ──────────────────────────────────────────────────
@@ -76,6 +78,10 @@ import {
 	isReviewRequired,
 	isSubagentReviewRequired,
 	isDocumentationRequired,
+	isDogfoodRequired,
+	getDogfoodDeployMatrix,
+	getDogfoodDepth,
+	isDogfoodActor,
 	isLiveDocsRequired,
 	getLiveDocFailureThreshold,
 	getResearchToolPatterns,
@@ -88,6 +94,10 @@ import {
 	getLastReviewResultForWorkspace,
 	resetReviewState,
 	sessionReviews,
+	recordDogfoodResult,
+	getLastDogfoodResultForWorkspace,
+	getDogfoodRecordsForWorkspace,
+	resetDogfoodState,
 	setSessionWorkspace,
 	getSessionWorkspace,
 	getSessionBoundWorkspace,
@@ -117,6 +127,10 @@ export {
 	isReviewRequired,
 	isSubagentReviewRequired,
 	isDocumentationRequired,
+	isDogfoodRequired,
+	getDogfoodDeployMatrix,
+	getDogfoodDepth,
+	isDogfoodActor,
 	isLiveDocsRequired,
 	getLiveDocFailureThreshold,
 	getResearchToolPatterns,
@@ -127,6 +141,10 @@ export {
 	getLastReviewResult,
 	getLastReviewResultForWorkspace,
 	resetReviewState,
+	recordDogfoodResult,
+	getLastDogfoodResultForWorkspace,
+	getDogfoodRecordsForWorkspace,
+	resetDogfoodState,
 	setSessionWorkspace,
 	getSessionWorkspace,
 	getSessionBoundWorkspace,
@@ -194,7 +212,7 @@ import {
 	summarizeInput,
 } from "./lib/audit.ts";
 
-export { getAuditFilePath, getVerifyCacheFilePath, getReviewCacheFilePath, getVerifyHistoryFilePath, persistVerifyCache, loadVerifyCache, persistReviewCache, loadReviewCache, getRecentAuditEntries, getRecentVerifyHistory } from "./lib/audit.ts";
+export { getAuditFilePath, getVerifyCacheFilePath, getReviewCacheFilePath, getDogfoodCacheFilePath, getVerifyHistoryFilePath, persistVerifyCache, loadVerifyCache, persistReviewCache, loadReviewCache, persistDogfoodCache, loadDogfoodCache, getRecentAuditEntries, getRecentVerifyHistory } from "./lib/audit.ts";
 export { summarizeInput };
 
 export function managedConfigDiagnostic(platform = process.platform, env: NodeJS.ProcessEnv = process.env): string {
@@ -694,6 +712,14 @@ export const WorkflowGuard: V1Plugin = async (ctx: Parameters<V1Plugin>[0]) => {
 						`- Secondary Review: ${lastR.passed ? "APPROVED" : "CHANGES REQUESTED"} by ${lastR.reviewer}`,
 					);
 				}
+				const dogfoodCtxGate = evaluateDogfoodGate(effectiveRoot);
+				if (dogfoodCtxGate.required) {
+					stateLines.push(
+						dogfoodCtxGate.missingHosts.length === 0
+							? `- Dogfood Evidence: PASS on ${(dogfoodCtxGate.matchedRecords ?? []).map((record) => record.host.label).join(", ") || "recorded host"}`
+							: `- Dogfood Evidence: MISSING for ${dogfoodCtxGate.missingHosts.join(", ")} (required before PR creation)`,
+					);
+				}
 				let openFollowups: ReturnType<typeof listReviewFollowups> = [];
 				try { openFollowups = followupStore ? listReviewFollowups(followupStore, "open", 8) : []; } catch {}
 				if (openFollowups.length > 0) {
@@ -838,6 +864,7 @@ export const WorkflowGuard: V1Plugin = async (ctx: Parameters<V1Plugin>[0]) => {
 					projectMemoryEnabled,
 					learningEnabled,
 					recoveryCheckpointsEnabled: isRecoveryCheckpointsEnabled(effectiveRoot),
+					dogfoodRequired: isDogfoodRequired(effectiveRoot),
 					isReadOnly,
 				});
 				output.system.push(guidance);